u';j:::fl11"!6hwn,n\"!f1ru:::m';j~fl1';jr;1.:Jb6'1~~fl1';jJ;l.:J'Vl'U,.

b~'El.:J'UlCJtJ1CJ bbJ;l::: b~U'J'tJ ~'illi1'Ufl1';j~f1'I~1f111~~'UfI.:JUJ;l 'El1?1.tlCJ~1'U6'11';j6'1'Ub'I'll"!

b~'El1~';j:::tJtJ b'Vlfll'U lJ;l~6'11';j6'1'Ub'Vll"! bbJ;l:::f11';j~'El6'11';j "lJ'El.:J6hUn.:J1'Uflru::: m';j~f11';jr;1.:Jb6'1~~
f11';jJ;l.:J'Vl'U
bbJ;l:::6'11~1';jt1~1 bU'U.:J1'U1~'El ~1.:J~m~'El.:J, b. u'U1U'El ~~.:J~u';j:::?i'VlB.fl1'1"l ~ m1~~'UfI.:J'\.JJ;l'ElI?1.tlCJ.

IV..:::..d'QJ0~. :::..

ddd!U

111?11 CJfl1';jm:::'Vl1f111~t:J1?1 bnCJdntJfI'El~Wd b~'El';j 'I"l,I"!. k>crcro bbJ;l:::n~;rV!~1CJ'El'U'VlbnCJd"lJm

mpj'm)1'U11iJ\9l1~f111~1'U~1~';j1 cr bbJ;l:::~1~';j1 gJI bbvl.:J'I"l';j:::';j1"lJn~~~fl1fhV!'UI?1'V!~f1bnru4ibbJ;l::: .
1~fl1';j1'U fl1';jvr1'B';jm';j~'Vl1.:J~h~n'Vl';j'El-Wn61.fl1f1~:O,..... 'I"l.I"!. k>cr<s::~ bbJ;l:::'\.J';j::: f111"!f1ru::: m';j~f11';j'B';jm';j~'Vl1.:J,,VI,j1CJ~11J~eJ"I~~..... ~.f!l. l!JcfcfQ1 bb~~~trtJVi l!J ~.f!l. 1!Jct:cfb G11,rn":)11Jr1ru~fl~'jlJfl1'j61":)b61~lJfl1~~":)V11J,~.:J'El'Eln'\.J';j:::fl11"! ~.:J~'El1'\.J-do['El (9) b~CJf1b~n'\.J';j:::fl11"!611-Un.:J1'Uflru:::m';j~fl1';jr;1.:J b6'1~~fl1';jJ;l.:J'VJ'U b~'El.:J 'UlCJtJ1mbJ;l:::bb'U1'\.JlJu~

b'Ufl1';j~n~1f111~~'UfI.:J'\.JJ;l'ElI?1.tlCJ~1'U6'11';j6'1'Ub'Vll"! "lJm611-Un.:J1'Uflru:::m';j~fl1';jr;1.:Jb6'1~~fl1';jJ;l.:J'Vl'U, 'I"l.I"!. k>ctbo
QJq..:::..

J;l.:J1'U'Vl (9)b 'I"l~I"!IiJfl1CJ'U k>ctbo.

o['El k> '\.J';j:::fl1I"!-db~CJn';h '\.J';j:::fl11"!611-Un.:J1'Uflru:::m';j~fl1';jr;1.:Jb6'1~~fl1';jJ;l.:J'Vl'U.
, b~'El.:J i.!lCJtJ1E.lbbJ;l:::bb ~1'\.JlJU~b 'U fl1';j~n~1f111~~'U.f1.:J'\.J J;l 'El1?1.tlCJ~1'U6'11';j6'1'U b'I'll"! ~'El.:J611-uf1.:I1'U f1ru:::m';j~f11';jr;1.:J b6'1~~f11';jJ;l.:J~'U'I"l.I"!. k>ctbgJI
o['El Q'lb'U'\.J';j:::fl1l"!tl((9)) 611-uf1.:l1'U 'V!~1CJfl11~';h 611-Un.:J1'Uflru:::m';j~fl1';jr;1.:Jb6'1~~fl1';jJ;l.:J'Vl'U,(k»' t:J1oU.:J1'U'V!~1CJfl11~';h "tI1';j1"lJfl1';j b~1'V!'1hvl 'I"l-un.:J1'U"lJ'El.:J~:O J;ln~1.:J~l?1bbJ;l';j:::tJtJ
'U
CU
'U'U
.
d.S:

t:JtJ~'V!1~"lJ'El~611-uf1.:l1'U ~~tJtJ~fl1';j t:J1 oU.:J1'U~11'\.J
'U

'U

'U'

(Q'l) ?i'VlB"lJ'El.:JmoU.:J1'U'V!~1CJm1~';h ?i'VlB~11'\.J ?i'VlBI\l'1b'l"l1::: ?i'VlB-Wb~~ bbJ;l:::?i'VlB~'U11?1
'U
d d

v

Q.I

0

Q.I

'Vl bn CJd"lJ'El.:J ntJ';j:::tJtJ6'11';j6'1'Ub'Vl1"!"lJm6'11'Uf1.:I1'U(<s::)?i'U'Vl~'I"l6 (asset) 'V!~1CJfl11~';h ~.:J1I?1flm~~~f1ru~1611'V!~tJ611-uf1.:l1'U,

-I!J­m~V15 Vl~eJ milJeJ'UB1'UT'ilb ~ v -tl'l1'U b'ihfi~ Vl~eJ b-tl'll'U bl"l~eJ'lh ~ Vl~eJ'J:::'U'U
.~

~W:

~({

~

.

II~

(;'/1'J(;'/'UbVlPl V1'lVl1'lmG'lnVlieJ'Un(;'/bbG'l:::V11~m~fl1'v;'J1lJVI~m'JeJ'UqJ1l'1b"1l'W11'U'U.
. G11Vl-r'U'4rtI"lG'lm~'UeJn l'IG'leJ~I\I'Uml\ln1Vl'U~-ifmJ~Uib5mn'Umib'ihfi'lb~~il"1leJ'U

bmH~1~m~(0)1"l11lJri''UI"l~'\JG'leJ~i1t:J~1'U(;,/li(;,/'ULVlPI (Information Security) VllJ1~1"l111.d1
m':ifi1i~H~'l1"l11lJGl'U (Confidentiality) 1"l11lJ~n~tl'lm'U(b'U' (Integrity) bb(;l:::61fl1'v;'v;~eJlJ1-tl'l1'U (Availability) ~eJ~(;'/li(;,/'UbVlPl ':i1lJ~'lf1ru(;,/lJU~~'U 1~bbfi
1"l11lJ~n ~eJ~ bb 'V11\1 ~~ (Authenticity) I"l 11lJ-r'U ~ ~ (Accountability) nl'rVl1lJ'\J~b(;'/DI"l11lJ~'U~~ (Non-Repudiation) bb(;l:::1"l11lJ'I<hb~eJfieJ (Reliability)(~) bVll9lm':iru~1'U1"l11lJri''UI"l~'\JG'I~~i1~ (Information Security Event) Vl1J1~1"l11lJ';h.

mru~':i~'Um'Jbn~bVll'lm~ru(;,/fl1'v;"1IeJ~'U~mi Vl~ml"l~eJ'!htl~bb(;,/~'l1~b~'U1"l11lJ,
btJ 'U1 '\Jl~~1\1 ~bn ~ mi~l~'U'Ubtl 'U1 tl ~1'U1"l11lJri''U I"l ~'\J (;l eJ~i1tl Vl~eJ lJ1l'1im i\j eJ~n'U~
b~ C.l1-ifeJ'ln'U 1"l11lJri''UI"l'l, "'lJ bVl~1 Vl~mVll'l• f11':iru~'Ul&JeJ11\1-n~'h~11\1v'\J(;leJ~i1C.1(c::i) (;'/ t11'U n 1 ':iru ~1'W 1"l11lJ ri''U 1"l'l'\J (;l eJ ~i1 tl ~1&J ~~'\J ':i~(;'/ ~ fi 'VI ~~1&J eJ11\11"l1 ~ fl ~(Information Security 'Incident) VllJ1C.1I"l11lJ";h (;'/m'Umiru~1'U1"l11lJri''Urt'l'\J (;l eJ ~i1 tl ~1&J~ 'I Lh::: (;'/ ~rlVl~ eJ1&J eJ 11\1 rt1 ~ fl~' (Unwanted or Unexpected)~~ml\l'vi'11~':i~'U'U"1IeJ~ci'lirn~l'Wt1 n'U mnVl~eJbl\llJ~ 'bm~rt11lJri''U 1"I~'\J(;leJ~i1tlt1 n
'U'11

'U.

(>\'1 b'W 'U n1'J~1 tl1~m 'JVI 1'1 Bb~nVl 'JeJ'W m1 b~eJ1 'Vi(;'/llJ 1 'Jt11-il''l1'U(;'/1 'J(;'/'U bV11"11~

l'I1lJtJn~eJci1~~mileJ>1(rn) m':il'l':i11\1(;,/eJ'Ubb(;l~tJ'J:::bil'U1"l11lJb~tl'l~1'U(;,/li~'UbVlPleJci1~(;,/~lb(;,/lJeJ

-m­

(9))

fl1~..ijI?l'Vi'1oUEltJB'lJm~?IEll?lfl~El"l ri'tJ'uLCJ'U1 CJfl1~-rfl~1fl1111iT'W fl"ltJ ~ ElI?1.nCJ~1'U .
?I1';i?l'Wb'VI1':!'r(I!»

fl1';itJ';i~fl1Vl1'WLCJ'U1CJbbfl~oUEltJB~#i'''lflg:J11t~~b~moUEl"l~.:jVllll?1-r'U'VI';i1'IJ b~Elb Vi .
?I1:IJ1~t'l boU1f;1"l boU1b"iJ bbm;tJB~(91111'WbCJ'lJ1CJ bbfl~oUEltJB~1~(m) fl1'H)1V1'WI?1~-r'IJ~I?1"11El'IJ (91111'WbCJ'U1mbfl~oUEltJB'U1\#i'.:jflg:J11bViotil?1b"iJ'W(~) fl1';i'VI'IJ 'VI1'WtJ -r'IJtJ ~.:j'WbCJ 'lJ1 mbfl~oUEltJB,rMVibt1'WU"iJ"il'IJ'WEl ~ b?lllEl
oUEl b b;1ElVl1b'Wfl1 ';i-rfl~1fl1111iT'W
fl"ltJ ~ El 1?1,nf:J~1'W?l1 ':i?l'W b'VI VlI tJ ':i~ flEl'IJ ~1 CJ?l1':i~cl'1~f,lfv.

(9))

f11':irl1V1'Wl?lfl1'aoU1f;1"lbb~~fI1'IJfl:IJf11':iboU"l1'W?l1':i?l'Wb'VIVll(Access ControL) #i'''lii•(@'l.(9)) f11':ifl1'IJflllfl1':i boU1f;1~oUElll~
bbfl~EltJmru''Wf11':itJ'j"~:w'J(le.J(loUElll(lbl?1f:Ji"hw"l
\I
It
, \ I
'i

f;1"lfl1':i1.u{l1'W bb(l~fl1111iT'Wi·l"ltJflEl 1?1,nf:J(9).I!»

fl~ bflru ~ b~ CJ1 fl'IJ fl1~El'4 'Y 1(911Vi boU1Q"l 1i fl1 ':i fl'1V1'W 1?1 (911:IJ 'W bf:J'IJ 1 f:J
q

cv

V

Q

o.

~

~

~

0

'VI bfl tJ1"11El{l fl'IJ fl1':ieJ'4'Y 1(91 fl1':ifl1V1'WI?I6'1'V1u VI'j"El fl1'j":IJ El'IJ eJ1'W 1"iJ"I1eJ"l,hUfl{l1'W(@'l.m) fl1':ifl1V1'W 1?1 b~ tJ1 fl'IJtJ ':i~ bfl'VI"l1el"loUElllfl ~i1#i''IJ fl1111cl'1~f,lf V!1mi1#i''IJ~~~'W fl1111 '"'IJ"I1 El{loU Elll (I 'j"111 ~{I ':i~ #i''U i'W fl1 ':i LoU1 f;1"l b1 (11 ~1~ boU1Q "l.,"" ",

bb(l ~"I1El{l'VI1{1f11':ib"lJ1t'l"l(I!»

fl1'j"fl1v1'W1?I fl1'j"1oU{l1'W ~111fl1':in"iJ b~eJ f11'U ~:lJfl1':i boU1 f;1"l?l1':i?l'W b'VI VlI (Business

Requirements for Access ControL) bl?1mb'IJ{lfl1':i..ijI?1'VhoUEl-JB'IJ~ btl'lJ I!> 1:f1'W..

~ El fl1 'j" fl1 'IJ flll
, fl1 ':i boU1 f;1{1 ?I 1 'j"?I'W b'VI VlI bbfl ~ fl1 'j"tJ -r'IJ tJ 'j" {l1 Vi?I eJ 1?1 fl ~ El{l fl'IJ
oUEl n1V1'W1?1f11'j"1.u{l1'W (911 llfl 1'j"fl"iJ Lbfl~oUEl n1V1'W 1?1~1'W fl1111 iT'W fl{ltJ fl El 1?1,ntJ(m)

f11'j"'lJ5V11'j"..ijI?1f11'j"f11'j"boU1f;1{1"11El~~~{l1'W (User Access Management) L~eJfl1'IJ~1l

fl1~boU1Q"l'j"~'IJ'IJ?l1'S?I'Wb'VIVlI bu'rl1~~m~-r'IJ El'4'Y11?l bL~1 bb (I ~/Vl1eJt:J1'W fl1'j"t1 fl tl'IJ';ill
VI '" fl?l (91 'j" fl1 'j"6'1 ~1 {I fl1111 (91 'j"~~Vii! flb~ tl {I fl1111 it'W fHtJ fl eJ 1?1,n tJ?l1 ':i~ 'W b'VI VlI ..

(information Security Awareness Training) b~eJ'IjeJ"lfl'Wfl1'j"boU1f;1"l"iJ1fl~~"lv.

1111~-r'IJeJ'4'Y11?l #i'{I\i. (m.(9)) fl1':i?l~1"lfl1111 if111:IJ LoU1 h 1Vi fl'IJ 0~"l1'W L~eJ1Vi bnl?1fl11111?l';i~Vli!flf111:l..1 boU1h f;1"l,n1:.1 bLfl ~e.J(I m~'VI'IJ~ bii 1?1"iJ1 flfl1':i1.u{l1'W'j"~'IJ'lJ6'11'j"?I'WL 'VIVlIb\?1tJ1:lh~ill?l'j"~1"l VI~eJ~b 'VhhJf;1{1 fl1':iru 'j"111f;1{1fl1V1'W1?I1Vi1i1l11?l'j"f11';ib"If"l

"

-~-

(m.~) fl1'j~.:J'VI~bUtJ'U0off.:J1'U (User Registration) i1.rr'UI'l'el'Ufl1'jtJlJU~~lVl-r'U
fl1'j~.:J'VI ~ btj tJ'U m off.:J1 'U b~ 'el i1 fl1 'j'el 'U ru 11'l1Vfb-if 1~.:J'j ~'U 'U?f 1'j?f'U b'VI Pl
'U

'I

'V

•

(m.m) fl1'j'U~Vl1'j~\?lfl1'j~'VI5"1J'el.:Jmoff.:J1'U(User Manaoement)
i1fl1'jI"l'J'Ul"llJ~~,

bb~~1il1 ii'\?l~'VI5b~'el b-if1~~ bb~ ~1off.:J1'U'j~'U'U?f1'j?f'Ub'VI Plbbl'l'~ ~"1Jti~ I'lllJl"l'J1lJ
...

" .,.

fl'Ufl1'jb"1J1m(m.~) fl1'j'U~Vl1'j~\?lfl1'j'j~?f~TW6'11Vl-r'U0off.:J1'U (User Password Management)
i1 m~'U'J'Ufl1'j'U~Vl1'j~\?l fl1'j'j~?f~1'U~1
Vl-r'U.

moff.:J1'U'el ~1.:J-r\?l fllJ,~.(m.cr) fl1'j'VI'U'VI'J'U~'VI5fl1'jb~1~.:J"1J'el.:J0off.:J1'U (Review of User Access Rights)
i1 m~'U'J ti fl1 'j'VI'U 'VI'J 'U ~'VI5fl1'j b-if1~.:J"1J 'el.:J.

enoff.:JTW 'j~'U'U ?f1'j?f'U b'VI Pll'lllJ
~

." °
1"'J
'j~tJ~b'J~l'V1fl1Vl'U\?l(~) fl1'jn1Vl'U\?lVlti1~1"l'J1lJ-r'U~\?l"1J'el'U"1Jm0off.:J1'U (User Responsibilities) .b~mjmii''U
fl1'jb-if1~.:Jl\?ltJbJ1~-r'U'el'U ru11'l. fl1'jb1J \?lbt:JtJ fl1'jG'l'J.:J~
Vl~'elfl1'j~fl~'el'lJ'Vh;i1b'U1-if'ellJ~' t I . '
'tI
.

'i

Q,J

?f1'j?f'Ub'VIPl bb~~fl1'j~fl"1JllJtJ~tJ mrutJ'j~lJ'J~ t:J~?f1'j?f'Ub 'VIPl \9l.:J-Q(~.C9») fl1'j1off.:J1'U'j~?f~1'U (Password Use) i1fl1'jn1Vl'U\?lbb'U'JtJlJU~~~~lVl-r'U
m off.:J 1'U1'U fl1'jflo1 Vl'W \?l 'j~?f ~ 1'U fl1 'j1off.:J1'U 'j~?f ~ 1'U bb~ ~ fl1'j btJ ~ tJ 'U
~

cv

I

cL::~

'jVl?ft:J 1'U'VIlJ I"l,ru .fll'V,~(~. ~) fl1 'jU 'el.:Jii''U 'el, tJ ~ 'j ru1'U"1J ru ~~hli1 en off.:J1'U ~ 'el tJ fl 'j ru i1 fl1 'jfl01Vl'U\?l~,. (~.~~ fl1'jI"l'J'U~lJ~'U'VI-r'W~?f1'j?f'Ub'VIPl bb~~fl1'j1 off.:J1'U'j~'U'UI"l'ellJ'W'Jbl'l'el~ (Clear

Desk and Clear Screen Policy) i1 fl1'jI"l'J.'U~lJhl1Vf~'U'VI-r'W~?f1'j?f'Ub'VIPlb"11'U b'elfl?f1'j ~'elU'UVifl-if'ellJ~ l"l'ellJ'W'Jbl'l'el~ ~~'el?f1'j?f'Ub'VIPl 'el~1~.fl1'J~~~"il1m~'U'U?f1'j?f'Ub'VIPlb~e:d1.:J b1'U"il1flfl1'j1-if.:J1'U(~.~) 0 -if.:J1'U'el1"iJ'l11fl1'jb-if1'j~?flJ11offn'U-ifm,j~~ btJ'UI"l'J1lJ~'U 1\?l tJ1VftJlJ~ I'l1lJ

(cr)iim';j)011'U)01llflTwihfj.:lb)01~€l·thtl(Network Access ControL) b~€lU€l.:lti\.!m';j,IAhfj.:l'U~m';j'VI1,:jb)01~€l'1htI1(PJtl1111~i''U€l'lJru1\1l ~,:j;l.

,u(~.®) m';jl-if,:j1'UtJ~m':ib)01~€l·thtJiim';jn1V1'U(PJ1~m-1J,:j1'U~11l~1tlb"ihfj,:j';j:::'U'U
.
.

.

.

.~

~11~'Ub'VI~\~bbl9l bv:ltl.:l'U~m';jm~i''U€l'Uru1\1l1~b-1J1fj.:lb
VITu'U, u.

. (cr.~)· m1~'Uci'U~1\!)01)01~6'11V1i''Ur:rt-1J~€l~.fI1tJ'U€lmhuf1'l1'U (User Authentication
for ExternaL Connections) iim1n1V1'U(PJ1~iim';j~'Uci'U~1'Uf1)01~n€l'U,~til~€l'Uru1\1l1~m-1J~mJ.m tJ'U€lmhUfl.:l1'U ~11l1';jtl b-1J11-if.:l1'U b)01~€l·thtl
'i

QJ

'U

\.I

bb~ ~1:::'U'U~1';j~'U b'VI1'll'1J €l~6'11'l1m1'U1~(cr.Gn) m';j';j::\!~t1mru'U'Ub)01~€l'li1t1 (Equipment Identification in Networks)

ii15m1~~11l1';jm~'U€ltlmru'U'U b)01~€l'li1 tI\~ bb~:::1-ifm':i1:::'U€ltlmru'U'U
It q

'i 'i

L)01~€l'li1m1J'Um1~'Ur:J'U(tr.~) m';jU€l,:jn'U'V'l€lj\1lvi1-if6'11V1~'U\1lTI\J~€l'UbL~~~'Ubbl9l~';j~ (Remote Diagnostic
and Configuration Port Protectfon) iim';j)011'U~llm';jb-1J1fj.:l'V'l€li\1lm-if•~1V1i''U m1til ~€l'U bb~ ~t1i''U bi, 19l.:l';j:::'U'U Vl'l m';j boih fj.:l'VI1.:lmtlf11'V'l bb~ ~'VI1.:l~)01~€l'li1tJ(cr.cr) m';jbbti,:jLLtlm)01~€l'li1tJ (Segregation in Networks) iim';jLbti'lbbtJm)01~€l'li1t1~11lmill'1J€l'l'U~m':i~1':i~'Ub'VIl'll fl~llm-if~1'U bb~:::fl~1l'1J~.:l';j:::'U'U~1';i~'Ub'VIl'll
Ii

'i

\I

'i

b~€llll9lm:::Vl11'l6'11'l1m1'U1~~€l(PJ)01~€l'ln'U-if€ltl~llilm1)011'U~llfl1';ib-if1il.:l(cr.(;'))) m';j)011'U~llm';j~(PJLs1'U'VI1~'U'Ub)01~€l'li1tJ (Network Routing ControL) iin1';j)011'U)01llm';j~(PJ Ls1'U'VI1.:l'U'Ub)01~€l'li1tJ b~€l1~m1b~€llll9l€l'1J€l'l)01€lllYl1 b\1l€li,. bb~:::m';jsi.:l~h'UVI~€l1VI~ b1t1'U'1J€l.:l-1J€l\l~VI~€l~11~'Ub'VIl'll ~€l.(PJ)01~€l~rt'U-1J€l1Jfi'li1m';i)011'U)01llm';ib-1J1fj'lVl~€lm1t1';j:::tlfll>il-if"l1'Umllf11';in~':.J,,(b) m';jm'U~llm';jb-1J1fj'l';i~'U'UtI~u~m';j (Operating System Access ControL)b~€lU€l.:ln'Um1b-1J1fj"l1:::'U'UtI~'Ii1 m';jb(PJtJ1111~i''U€l'4f!:!1\1l ~'l;lp.I·1(b,@) n1V1'U (PJ-iJ'U\1l€l'U'lJ~u~ bv:l l€ m';j I,""

oih1-if'l1'UVi:w'U)01"ltl ~€l(PJ.ntJ b(PJ tJ m';i L-1J1 fj.:l';j:::'U'UtI~'Ii1 m';i iim';im'Ufi,l1l1(PJtJ15m ';j~'Uci'U~1\1l'U~~'U )01'ltl ~€l(PJ.ntJ(b.~) fl1';j';i:rub~:::~'Uci'U#i'1\1l'U'1Jrnm-if'l1'U(User Identification and Authentication)
,
~

q

'V~iJ

0

..J

-dV

QJ

l.lm';jmVl'U(PJ bVlf..l b'1J'l1'U1l'1J€lllm~'V'l1::: b\J1:::til"l 61f.:l~11l1';jt1';j::'U\1l1\1l'U'1J€l~,~~m -if~1'U bb~::ba€lfl14f.ff'U \1l€l'U'VI1.:lL'VI)01'W)011'U m';j~'Uci''U#i'1\1l'U~ bVl1l1~~1l
.
~

..01

...

•

OJ

I

~I

~OJ

..01

"'"

b'I"Jm€l.:l';i'Um';jflm1€l1"l11bu'U~b"ll.:l1'U'VI';j:::\!O'l-0­(0.Q1) fl1';iU~Vi1·j';ijVlfl1';i~Vi'!;'ft.hw (Password Management System) llfl1~~VlviTVI ~tl~Vl1 ~1l~~uuu~Vi1';i~VI fl1~';iVi'!;'f ~TW ~!;'f1lJ1 ';i~'Vh!l TW ~"8~

L~(;ltlU (interactive) Vi~tlijfl1';ivi1~11.J11.J~rl'Mru~tl(;llwml,~~~~tll91tlfi1';i(O.~) fl1~bi~11.JL'lh bbfl';ilJtl~~~t1';i~LCJ"tiU (Use of System Utilities) ijfl1~
1il1nVlbbfi~ 1"l1Ul"llJfl1'';ib.g~11.JLt1';ibLmlJtI';i~ Lfl'Vltl';i';iC1t1';itLCJ"tiU L-rltlUtl-3n1.J,
fl1 ';ifi~ biJml1 ~tlVi~ fl b~ CJ-:J:l.J1(;l ';ifl1';i1"l11:I.Jri'1.J l"l-:JtI fitlVlilCJ~b~t11VitlVlb1
'"

.,J",

•

i.'

'

.

Vi';itl'VllJtlCJLLfi1'U(o.!t:) b~tlllfl1';i':h~ b11.J"il1fl fl1';i1i-:J11.J11.J';itCJt L1fi1Vi~-3 1 ~CJ~
, ri1';i1i-:J11.J';itUU'!;'f1~!;'f1.Jb'VI9l1,r1.J (Session Time-Out)·(0.0) fl1';i"il°1n VI ~~ CJ ~ b1fi 1 fl1~ b~ tllJ 191 tl ~tU U!;'f1 ';i!;'f1.J b'VI ia1 (Limitation ofConnection Time) ijfl1';i,l'1nl91';itCJtL1m11.Jfl1';ib~tllJl91tl ~~tl1~il\"lJ1lJ
iT1.J l"l-3iJfitl 191ilCJlJ 1 fl ~-:Jsff1.J6f1Vi~U~~ UU !;'f1';iG'l1.J b'VI ~Vi~tl bb tl'l"l 'I"l~ bl"l.ff1.J .

(Applicati6~ and Information Access ControL) ~~d(mi.@)

fl1~1il1nl91fl1';ib-if1~~!;'f1';iG'l1.JL'VI9I1 (information Access Restriction) llfl1~
1il1n191 1"l1U I"llJ
fl1~L -if1i1-:J Vi~tl b-if11.g-:J11.J"lItl-:Jm,.g-311.J~Lfi~Ul"lfi
1fl~~1 CJ
If
IfJ
'I
~

G'lUUG'I'W'Wfl1iL-if11i-:J11.J
11.Jfl1';i b-if1i1-:JG'l1';i!;'f'W b'VI9l1 LLfit-W-:Jt1otl1.J (Functions),
1911-:J "1 '1Jtl-:JLt1iLLmlJtli~CJfl~Vi~tlbbtl'l"l'l"l~bl"l.ff1.J~~d LI91CJG'ltll91l"l~tl-:J(;l1lJ
,
,

"''''
d
'"
i.'
. '1bl91~Ufl1';iLLCJfltltl
fl"il1flitUUtl1.J"1 bbfitlJfl1';i\"lJUl")lJ!;'ffl1'1"lbL1l91fitllJ'1Jtl-3(;l'W Ltl-:JLI91CJLu'l"l1t LI91 CJllfl1il"l1u I"llJtl't1, , mru I"l tllJ¥l1 b(;ltl{ bLfit ~tl!;'f1';i ,LI"l~tl'W~ bLfi~fl1'atl~U~-:J11.J"il1flmCJ1.Jtlfl~1ufl,n'W (Mobile Computing
and TeLeworking)(mI.Q1) fl1i I"lTU I"llJtltl fl ';iruI"l tllJ¥l1 b(;l tl{bbfi ~ ~tl!;'f1ibl"l~ tl1.J ~ II fl1i t11Vi'WI91-iftl• •t1~U~bbfi~lJ1(;lifl1i~ bVilJ1t!;'flJ b~tltl mJtl-:J!;'f1i!;'f1.J b'VI9l1"il1flI"l11li L~ CJ-:J(g)).~) fl1itl ~ U~-:J11.J"il1fl fl1 CJ1.Jtlfl6'i1Ufl-:J11.J (TeLeworking) II fl1it11Vi1.JI91-iftl

t1~u~ bb~'W-:J11.J bbfi~.ff'W(;l tl1.JtI~u~ b-rltltl~u1i6'i1Vi~Ufl1itl~U'ffi~11.J'1Jtl~~1Ufl-:J11.J"il1flfl1CJ'Wtlfl~1Ufl~11.J

-b'lI­(~) m)-<il~1'i'1)~'U'U6h~tl~ ~hb'ij'Wm)19I1:IJbb'W1'Vl1~~tll,ji1 .
(~.(9) iJmi~"iJ1~ru1R~L~tl mbl;l~-<il~1'i'1)::'U'Ua1)tl~~LVI:lJ1:::&'i:IJ 1 ~tlttl'W&'ifl1V'1'Uv 1v "lV'I':itl:IJ "11~1'W'VlbVI:lJ1:::~:IJ(~.kJ) i!'fl1)~~'Vi1bU:·J'W Ll9I ~tJ:IJ~11:IJV'I ~tl:IJ fl)ru~mu'W 1'W fl)ru~hj~1:IJ1it1~1 b'W'Wfl1i~htl15fl1':i'Vl1~~ b~m/litl'Wfl~ L~tl1~~1:IJ1it11-rr~1'W~1)~'WL'Vlf41

1~19I1:IJU fl~ tl ~1~~tl b~tl~ 1~ tJ~tl ~u~'Uu~~ bLtl-J 'W bl9l~tl:IJ fI'J1:IJV'I ~tl:IJ mru~flLu'W~~mh11~~1:IJ1':it1U~'U1.m~tl~1~!.VI:IJ1:::~:lJbLl;l:::~tl~fl"'tl~i1'Umi
1-rr~1'W19I1:IJm':ifi"iJ(~. m) iJ m) n1V1'W~VI,j'1~ LL!;l::fl11:IJ-r'lJ ~ ~"11tl'U"lItl~'U fl!;l1 fli~~~ Lb!;l-r'U~ ~"11tl 'U
•

o

Q)

''U

0

.c::t

tor

q

i:::'U'U~1':i&'i'W·b'Vl f4I i:::'U'U6'/1itl~ Lbl;l:::fl1 )"iJ~'Vl1 bbtl-J 'W Ll9I) tJ:lJV'I )tl:IJ fliru.

UflbU'W1 'Wmru~hi6'/1:IJ1':it1~1b'W'Wm':i~1tJ15m':i'Vl1"lBL~fl'Vlitl'Wf1~­..::::I.r::::i

V

..

~

I

0

':i:::'U'U bLtl-J'W bl9l':itJ:lJV'litl:IJ fl':iruumu'Wtl tJ1~&'i:IJ1 L&'i:IJtl(~,tt) ci'1V1-r'Ufl11:IJ~"lItl~m':iU~'l1ru'Wbb~!;l:::-iJtl iJm':iU~~~b-Wtl"lV'ltl~a6'/.flTW
fl11:IJ I.~ m~ tltl:IJ-ru1~"lItl~a1'l1fl ,n'W(~) fl1)19I)'J"iJ6'/a'UbL!;l:::U':i::U1'Wfl11:IJL~tl~~1'W~1i6'/'UL'Vlf41 ~~i1
( ~ ,(9)

'"

01

""

"l

v

"l

"".!f

:IJ fl1) 19I':i1 "iJ6'/tl'U LI.l;l::: u ':i::: I.:IJ 'Ufl11:IJ L6'/ cHl i911'W ~1':i6'/'U L'Vlf41'Vl m "iJ Lfl ~"lI'W

i1'U1:::'U'U~1':i~'Wb'Vlf41 (Information Security Audit and Assessment)
j

21'

~

tltl1~'Wtltlul;l:::"QJ(9) fl)~(~, kJ) fl1il9l':i1"iJ 6'/tl'U
bL~ :::U':i::: Lil'U fl11:IJ L~tl~ ~1 L'W'U m ':il~ tJ~19Ii1"iJ &'itlU.fl1 tl1'W .
.
~.

a1'l1fl{I1'W (Internal Auditor) VI~tll~tlerl9l':i'J"iJ~tl'U~~':i:::~1'Wm1:IJit'Wfl~.
'U

U!;ltl~fl tJ."iJ1flfl1tl'W tlfl (Extemal Auditor) L~tl1't.1ci'1'l1fl~1'W1~'Vli1'Uii{j. i:::~'Ufl11:IJb~tl~bbl;l:::':i:::~'Ufl11:IJit'Ufl"lU!;ltl~fltl~1)~'Wb'Vlf!l"lla~ci'1'l1fl~1'U«(9)0) mrui:::u'Ufltl:IJ~1bl9ltl~VI~tl-iJB~l;l6'/1i6'/'Wb'VlI"lLn~fI'J1:IJ b~ tlVl1tl VI~tler'U\9li1tJ1~ 1
bLnci'1'l1m1'W VI~BerVl'ti~m~
er'Ub~tl~:IJ1"iJ1flfl11:IJ'UflV'l~m l;l~b!;ltJ VI~tl~1t1'Wm)'U'U

U~U~\9l1:IJ LL 'U1 'UbCJ'U1 CJ bLl;l::: bL 'W1u~u~1'W mi-rm~1m1:IJri''WfI~u~a~flCJ~1'U
6'/1i6'/'Ub'VJ1"l~'U~Vl1ii:::vl'U~~~~"lItl{jl!1'l1fl~1'W (Chief Executive Officer:

CEO). L'u'U~-r'U~~"11a'U~tlfl11:IJL~tl~. fl11:IJb5CJVl1CJ VI~tl8'W\9li1tJ~bfi~:ff'W.

-~--iffJ mI -ifmJ~u~1'Wfl'11~m:!J19'1'J1lJii''W9'I~tlflfJVl.neJfh'W?f11?f'Wb'Vlf'l~'W 1 "lJfJ~61Twfl~1'W 1 ~~1 bil'Wfl111J11lJfilim~'U'u 'WtmJ1 eJ rilifJtl~U~~1'W 15tl~u~~1'W bbfl~1~~'U 9'l11lJ b~eJ~m#i'''il1flfl11tl'H~ biJ'W~~,"lJfJ~1;hufl~1'W_ m#i'n1'Vl'WVlHIJI1lJlJ1!91';i~1'W ISOllEe 27001_

d1l-iffJ ~ 1~f'l'W6 L'Vl9'lt 'Wtfl~?f11?f'WL'Vlf'lLLfl~fl1';i~fJ?f11'llfJ~(;hwfN1'W l.iJ'WN~'U~Vl"IJfJ'U~1Lil'Wfl11
~

~

v

'

v

1~LiJ'WltlIJl1lJtl';i~fl1f'lii LLfl~1~lifl1';i'Vl'U'Vl'J'W'WteJ'lJ1mbfl~Lb'W'Jtl~oo~biJ'WD"il"ilU'WfJ~1~tifJeJtJfl~ (9) 9'1~~ 'Vl~fJ

b~fJiiflT:iLtl~eJ'Wbbtlfl~vi~1Aty91fJ~Twm1'W
ifJ ~ tl';i~fl1f'lm";1,.ifu~A'U~~bb~1W;1Vl"il1fl1'Wtl1~fl1f'l biJ'W~'W1tl

If

...

If

('W1eJ'W'llJllJ b'VlfJVl?fmM'fl~i)

Lfl"IJ1fifl119'1ru~fl1';ilJfl1';i?l~b?f~lJfl1';ifl~'Vl'W~'